CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
60.8%
Path Traversal is possible in Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName
.
With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. The file will be deleted immediately after the script ends.
Apply patch
--- a/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
+++ b/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
@@ -614,6 +614,10 @@
*/
public function getTemporaryFileName(string $suggestedFileName = null): string
{
+ if ($suggestedFileName) {
+ $suggestedFileName = basename($suggestedFileName);
+ }
+
$tmpDir = ini_get('upload_tmp_dir');
if (!$tmpDir || !is_dir($tmpDir) || !is_writable($tmpDir)) {
$tmpDir = sys_get_temp_dir();
Or decorate Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName
in your customization and clear $suggestedFileName
argument
public function getTemporaryFileName(string $suggestedFileName = null): string
{
if ($suggestedFileName) {
$suggestedFileName = basename($suggestedFileName);
}
return parent::getTemporaryFileName($suggestedFileName);
}
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
60.8%